@deksden-com/dd-flow-cli 0.9.0-beta.133 → 0.9.0-beta.134

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.134
+
+### Patch Changes
+
+- 7dae2f0: Freeze explicitly accepted RUN operational decisions and deliver the same verified policy/context to Stage and Work. Preserve their authority across recovery, require new acceptance for imported experiments, and retain native aborted-check reasons.
+- Deliver plan 082 Work authority, native failure evidence and Judge diagnostic repairs; admit the exact CP226 ZCode bridge after root, concurrent-child, same-child continuation and clean shutdown probes.
+- 46b7dbc: Persist stage usage through the shared completion service, including vNext SPECIFY and PROTOCOLIZE. Completed stage records now retain scoped token measurements for console readers; missing measurements remain unavailable.
+- 430a7df: Prepare writable parent directories before handing agents HITL, Work result and CODE blocker input paths. Preserve existing payloads and reject unavailable destinations without publishing unusable instructions.
+- 539de25: Capture bounded observation journals without requiring global runtime silence.
+  Retain RUN-scoped productive authority, immutable payload checksums and recovery
+  materials. Finalize stop-after captures as candidates after native settlement.
+- 9ca6bb3: Use scoped native progress and inactivity windows instead of productive-work
+  lifetime limits. Preserve observation uncertainty and exact operation fences
+  across quiet probes and observer replacement; bound utility output and cleanup.
+  Separate native-work and control waits across all six bundled adapters, keep
+  serving services exempt from output silence, and stop MERGE on confirmed lease
+  loss. New runtime contracts are operation-progress@1, operation-errors@2 and
+  native-operation-wait@1.
+- 0a8923a: Separate existing controller lease renewal from new launch admission so terminal RUNs can finish boundary capture and native settlement. Make terminal stop retain durable cleanup evidence without reopening productive recovery, and expose exact-owner finalization diagnostics. Full-cycle regressions now check sealed final capture and physical retirement before fixture cleanup.
+- 6b2c491: Preserve unavailable ZCode cache and reasoning counters as null instead of inventing measured zeros. Mixed histories keep optional totals unknown while retaining confirmed input, output, and total tokens.
+
 ## 0.9.0-beta.133
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.133",
-  "cli_commit": "43d88ec57e1b100fa29f31be925d6abfc976e7a2",
-  "built_at": "2026-10-12T17:50:10.957Z",
+  "cli_version": "0.9.0-beta.134",
+  "cli_commit": "b243f4dac38629b7f0398b3e0b1613904f4aebff",
+  "built_at": "2026-10-13T11:24:52.803Z",
   "built_with_canon": {
     "version": "4.1.2",
     "commit": "2ba0b9ceedf8e4544ad9566c240ef37ea5e8d099",

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -14,6 +14,7 @@ import { checkObservedProfile, observeModel, observedFields } from "./model-obse
 import { commandText } from "./process-json.mjs";
 import { readNativeLines, streamNativeDiagnostics, nativeObservationError } from "./native-streams.mjs";
 import { operationProgressReporter } from "./operation-progress.mjs";
+import { safeNativeFailure } from "./native-children.mjs";
 
 import { readZcodeUsage } from "./zcode-usage.mjs";
 const ZCODE_HARNESS_CONTRACT = "dd-zcode-harness@1";
@@ -569,7 +570,25 @@ export async function readZcodeSubagents(bridge, sessionId, timeoutMs = 30_000,
     cursor = page.ended.nextCursor;
     if (!cursor) {
       if (ended.size !== first.ended.total) fail("ZCode child directory is incomplete", "native_topology_incomplete");
-      return { ...first, ended: { total: first.ended.total, items: [...ended.values()] } };
+      const items = [];
+      for (const child of ended.values()) {
+        if (child.status !== "failed" || !Number.isSafeInteger(child.startedAt) || child.startedAt <= 0
+          || !Number.isSafeInteger(child.endedAt) || child.endedAt < child.startedAt || child.endedAt > 8.64e15) { items.push(child); continue; }
+        // Closed children must never be loaded merely to explain their failure.
+        let terminal;
+        try { terminal = await bridge.request("zcode/session/retainedTerminal", { sessionId: child.childSessionId, startedAt: child.startedAt, endedAt: child.endedAt }, timeoutMs); }
+        catch (error) { items.push({ ...child, terminal_metadata_unavailable: error.code ?? "terminal_metadata_unavailable" }); continue; }
+        if (terminal?.available !== true) { items.push({ ...child, terminal_metadata_unavailable: "terminal_metadata_unavailable" }); continue; }
+        const observedAt = Date.parse(terminal.terminal_observed_at);
+        if (terminal.sessionId !== child.childSessionId || typeof terminal.terminal_turn_id !== "string" || !terminal.terminal_turn_id
+          || terminal.startedAt !== child.startedAt || terminal.endedAt !== child.endedAt
+          || !Number.isFinite(observedAt) || observedAt < child.startedAt || observedAt > child.endedAt) fail("ZCode terminal failure metadata has foreign identity", "native_child_turn_conflict");
+        const providerError = safeNativeFailure(terminal.provider_error);
+        items.push({ ...child, terminal_turn_id: terminal.terminal_turn_id, terminal_observed_at: terminal.terminal_observed_at,
+          ...(providerError ? { provider_error: providerError } : {}) });
+        clock.sample(child.childSessionId);
+      }
+      return { ...first, ended: { total: first.ended.total, items } };
     }
     if (typeof cursor !== "string" || cursors.has(cursor) || !Number.isSafeInteger(first.revision)) fail("ZCode child pagination has no advancing, versioned cursor", "native_topology_incomplete");
     cursors.add(cursor);
@@ -923,6 +942,7 @@ export function zcodeLifecycleQualification(sha256, bridgeCommit, harnessContrac
     ["b9e0f5106dddb439b76186278bd9be5f45dbf3ef", "dd-zcode-harness@2"],
     ["636b14181d5c9a95476055079836fd6b58169f58", "dd-zcode-harness@2"],
     ["4621fabd3f517ecdd349dfebebae9077c01d2f2b", "dd-zcode-harness@2"],
+    ["9c5ca6cc81c4eb5065e43f8b7ab6b7cc5ab7ae47", "dd-zcode-harness@2"],
   ]);
   const qualified = qualifiedBridgeCommits.get(bridgeCommit) === harnessContract;
   return { status: qualified ? "qualified" : "unqualified", mechanism: "cli-invocation@1", sha256,

package/dist/harness-runtime/lib/native-children.d.mts

@@ -1,4 +1,5 @@
 export const NATIVE_CHILD_CONTRACT_VERSION: "native-children@1";
+export function safeNativeFailure(value: unknown): Record<string, unknown> | undefined;
 export interface NativeChild {
   session_id: string;
   parent_session_id: string;

package/dist/harness-runtime/lib/native-children.mjs

@@ -3,6 +3,22 @@ import { errorRecord } from "./operation-errors.mjs";
 
 function nativeFailure(code, message, exitCode, details) { return Object.assign(new Error(message), { code, exitCode, details }); }
 
+/** Retain typed failure facts, never provider headers, request bodies or free-form messages. */
+export function safeNativeFailure(value, depth = 0) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const result = {};
+  for (const key of ["type", "code", "source", "reason", "errorPhase", "exceptionKind", "providerId", "modelId", "providerKind", "transport", "retryable", "willRetry", "statusCode", "resets_at", "retryAfter", "retry_after", "retryAfterMs", "resetAt"]) {
+    const scalar = value[key];
+    if (typeof scalar === "boolean" || typeof scalar === "number" && Number.isFinite(scalar)
+      || typeof scalar === "string" && scalar.length <= 256 && /^[\w.:/ -]+$/.test(scalar)) result[key] = scalar;
+  }
+  if (typeof value.codexErrorInfo === "string" && /^[\w-]{1,128}$/.test(value.codexErrorInfo)) result.codexErrorInfo = value.codexErrorInfo;
+  else if (value.codexErrorInfo && typeof value.codexErrorInfo.code === "string" && /^[\w-]{1,128}$/.test(value.codexErrorInfo.code)) result.codexErrorInfo = { code: value.codexErrorInfo.code };
+  const attribution = depth === 0 && value.attribution && safeNativeFailure(value.attribution, 1);
+  if (attribution && Object.keys(attribution).length) result.attribution = attribution;
+  return Object.keys(result).length ? result : undefined;
+}
+
 
 /** Normalize provider-observed topology only; never parse assistant prose. */
 export function normalizeNativeChildren(receipt, rootSessionId) {

package/dist/services/controller-fanout.js

@@ -1,11 +1,13 @@
 import { AppError, errorRecord } from "../shared/errors.js";
-import { normalizeNativeChildren } from "../harness-runtime/lib/native-children.mjs";
+import { normalizeNativeChildren, safeNativeFailure } from "../harness-runtime/lib/native-children.mjs";
 import { getVnextFanoutStatus, observeVnextNativeChildren, reconcileVnextFanout, subagentCapacityKey } from "./vnext-fanout.js";
 import { getFlowRunVariables } from "./runs.js";
 import { dispatchVnextPlanReview } from "./vnext-plan-review.js";
 import { resolveExecutionPolicy } from "./execution-policy.js";
 import { lifecycleCommandCompletionInstruction, renderDelegationInstructions, stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
 import { assertWorkLaunchReady } from "./work-registry.js";
+import { requireProjectByRoot } from "./projects.js";
+import { stageWorkIds } from "./stage-work-graph.js";
 function semanticCompletionPrompt(stage, completed) {
     const task = stage === "plan-review"
         ? "Classify the reviewer findings, apply every accepted correction in the current PLAN-REVIEW Work, and write the authoritative review decision."
@@ -74,8 +76,23 @@ export async function nextControllerFanout(context, input) {
     const prompt = (action, text) => ({ kind: "prompt", action, prompt: action === "dispatch_work" ? text : `${text}\n\n${lifecycleCommandCompletionInstruction}`, fingerprint: JSON.stringify({ stage: input.stage, parent: fanout.parent_work_id, state: fanout.state, graph: fanout.graph_revision }) });
     if (fanout.state === "coordinator_required")
         return prompt("materialize_graph", `Continue the current ${input.stage} Stage using its authoritative packet. Materialize only its required Work graph with real dependencies. Do not launch children, finish the Stage, or start a successor. Return after registering the graph; the runtime will dispatch its ready Work.`);
-    if (fanout.works.failed || fanout.works.cancelled)
-        return prompt("repair_or_block", `Some ${input.stage} child Work failed or was cancelled. Inspect its recorded receipts. Choose a legal scoped repair/retry or block the Stage with the concrete reason. Do not relaunch settled siblings or infer success from a child that omitted work finish.`);
+    if (fanout.works.failed || fanout.works.cancelled) {
+        const projectId = requireProjectByRoot(context, input.projectRoot).id;
+        const members = stageWorkIds(context, projectId, input.runId, input.stage);
+        const failures = context.db.all("SELECT work_id,status,result FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ? AND status IN ('failed','cancelled')", [projectId, input.runId, fanout.parent_work_id]).filter(work => members.has(work.work_id)).map(work => {
+            let receipt = {};
+            try {
+                const value = work.result ? JSON.parse(work.result) : null;
+                if (value && typeof value === "object" && !Array.isArray(value))
+                    receipt = value;
+            }
+            catch { /* Missing legacy metadata is unknown. */ }
+            const providerError = safeNativeFailure(receipt.provider_error);
+            return { work_id: work.work_id, status: work.status, ...(providerError ? { provider_error: providerError } : {}),
+                ...Object.fromEntries(["terminal_turn_id", "terminal_observed_at"].filter(key => typeof receipt[key] === "string" && receipt[key].length <= 256).map(key => [key, receipt[key]])) };
+        });
+        throw new AppError("fanout_child_failed", "A child Work failed or was cancelled; no retry authority has been issued", 1, { stage: input.stage, run_id: input.runId, parent_work_id: fanout.parent_work_id, failed: fanout.works.failed, cancelled: fanout.works.cancelled, failures, effect: "unknown" });
+    }
     if (fanout.works.ready.length) {
         const choices = fanout.works.ready.map(work => {
             const payload = context.db.get("SELECT payload_json FROM works WHERE work_id = ?", [work.work_id])?.payload_json;

package/dist/services/hooks.js

@@ -18,6 +18,11 @@ import { registerProject, requireProjectByRoot } from "./projects.js";
 import { activeFlowSessionsForProject, recordFlowSessionObservation } from "./sessions.js";
 const defaultProfileName = "default";
 const maxSanitizedSummaryLength = 1600;
+function lifecycleObservationResult(receipt) {
+    return { observed: receipt.disposition === "admitted", duplicate: receipt.duplicate,
+        event_key: receipt.authoritativeEventKey, current_event_key: receipt.currentEventKey,
+        authoritative_event_key: receipt.authoritativeEventKey, receipt_disposition: receipt.disposition };
+}
 export const codexHomeSharedEntries = [
     "auth.json",
     "auth.bk",
@@ -410,6 +415,7 @@ export function handleCodexHook(context, input) {
             throw new AppError("codex_identity_missing", "Managed Codex lifecycle hook has no complete native invocation identity", 1, { invocation_id: invocationId });
         const executionCwd = assignedLifecycleCwd(context, project.root, lifecycle, providerSessionId, command, stringValue(payload.cwd), { daemonId, rootSessionId: rootProviderSessionId, sessionId: providerSessionId, parentSessionId: parentProviderSessionId, toolCallId }, "codex-desktop");
         const receipt = observeLifecycleInvocation(context, {
+            currentEventKey: eventKey,
             ...(invocationId ? { id: invocationId } : {}),
             command,
             harness: "codex-desktop",
@@ -421,12 +427,11 @@ export function handleCodexHook(context, input) {
         const stored = context.db.get("SELECT protocol_id FROM hook_events WHERE project_id = ? AND event_key = ?", [project.id, receipt.eventKey]);
         const admittedInvocationId = receipt.invocationId ?? invocationId;
         if (admittedInvocationId)
-            return { ...common, protocol_id: stored?.protocol_id ?? null, observed: !receipt.duplicate, duplicate: receipt.duplicate, event_key: receipt.eventKey, invocation_id: admittedInvocationId };
+            return { ...common, protocol_id: stored?.protocol_id ?? null, ...lifecycleObservationResult(receipt), invocation_id: admittedInvocationId };
         return {
             ...common,
             protocol_id: stored?.protocol_id ?? null,
-            observed: !receipt.duplicate,
-            duplicate: receipt.duplicate,
+            ...lifecycleObservationResult(receipt),
             hookSpecificOutput: {
                 hookEventName: "PreToolUse",
                 permissionDecision: "allow",
@@ -588,6 +593,7 @@ function recordZcodeLifecycle(context, input, invocationId, nativePreTool = fals
     let persistedResult;
     const executionCwd = assignedLifecycleCwd(context, expectedRoot, lifecycle, providerSessionId, command, observedCwd ?? undefined, { daemonId, rootSessionId: rootProviderSessionId, sessionId: providerSessionId, parentSessionId: parentProviderSessionId ?? null, toolCallId: toolUseId }, "zcode-acp");
     const receipt = observeLifecycleInvocation(context, {
+        currentEventKey: eventKey,
         ...(invocationId ? { id: invocationId } : {}), command,
         harness: "zcode-acp",
         projectId: project.id,
@@ -595,7 +601,7 @@ function recordZcodeLifecycle(context, input, invocationId, nativePreTool = fals
         identity: { daemonId, rootSessionId: rootProviderSessionId, sessionId: providerSessionId, parentSessionId: parentProviderSessionId ?? null, toolCallId: toolUseId },
         recordReceipt: scope => { persistedResult = persist(scope); return eventKey; }
     });
-    if (receipt.duplicate) {
+    if (receipt.disposition === "replay") {
         // Keep first admission immutable. A second transport is independently
         // retained corroboration, never another claim or an invented ACP cwd.
         const retained = context.db.get("SELECT event_name, match_key, harness, provider_session_id, parent_session_id, daemon_id FROM hook_events WHERE project_id = ? AND event_key = ?", [project.id, receipt.eventKey]);
@@ -615,7 +621,7 @@ function recordZcodeLifecycle(context, input, invocationId, nativePreTool = fals
     }
     const admittedInvocationId = receipt.invocationId ?? invocationId;
     if (admittedInvocationId)
-        return { ok: true, observed: !receipt.duplicate, duplicate: receipt.duplicate, event_key: receipt.eventKey, invocation_id: admittedInvocationId };
+        return { ok: true, ...lifecycleObservationResult(receipt), invocation_id: admittedInvocationId };
     // Without an issued managed attempt this is still ordinary hook evidence.
     // Preserve persist()'s replay result instead of overwriting it with the
     // admission layer's non-authoritative duplicate flag.
@@ -685,14 +691,13 @@ export function handleGrokEvent(context, input) {
     let inserted = false;
     const executionCwd = assignedLifecycleCwd(context, expectedRoot, lifecycle, providerSessionId, command, observedCwd ?? undefined, { daemonId: daemonId ?? "", rootSessionId: rootProviderSessionId, sessionId: providerSessionId, parentSessionId, toolCallId: eventKey }, "grok-acp");
     const receipt = observeLifecycleInvocation(context, {
+        currentEventKey: eventKey,
         command, harness: "grok-acp", projectId: project.id,
         ...(executionCwd ? { executionCwd } : {}),
         identity: { daemonId: daemonId ?? "", rootSessionId: rootProviderSessionId, sessionId: providerSessionId, parentSessionId, toolCallId: eventKey },
         recordReceipt: scope => { inserted = persist(scope); return eventKey; }
     });
-    if (receipt.invocationId)
-        return { ...result(inserted), invocation_id: receipt.invocationId, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, eventKey) } } };
-    return { ...result(inserted), hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, eventKey) } } };
+    return { ...result(inserted), ...lifecycleObservationResult(receipt), ...(receipt.invocationId ? { invocation_id: receipt.invocationId } : {}), hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: receipt.eventKey ? commandWithHookEvent(command, receipt.eventKey) : command } } };
 }
 /** Convert a controlled OpenCode tool hook into the shared lifecycle receipt. */
 export function handleOpenCodeEvent(context, input) {
@@ -900,11 +905,12 @@ function handleControlledToolEvent(context, input, event, harness) {
     if (lifecycle) {
         let inserted = false;
         const receipt = observeLifecycleInvocation(context, {
+            currentEventKey: baseKey,
             command, harness, projectId: project.id, ...(!shellRefusal ? { executionCwd: expectedCwd } : {}), identity: { daemonId, rootSessionId: nativeParentId ?? providerSessionId, sessionId: providerSessionId, parentSessionId: nativeParentId ?? null, toolCallId: toolCallId },
             recordReceipt: scope => { inserted = persist(scope); return baseKey; }
         });
-        const admitted = { ...result(inserted), ...(receipt.invocationId ? { invocation_id: receipt.invocationId } : {}) };
-        return agy || shellRefusal ? admitted : { ...admitted, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, baseKey) } } };
+        const admitted = { ...result(inserted), ...lifecycleObservationResult(receipt), ...(receipt.invocationId ? { invocation_id: receipt.invocationId } : {}) };
+        return agy || shellRefusal ? admitted : { ...admitted, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: receipt.eventKey ? commandWithHookEvent(command, receipt.eventKey) : command } } };
     }
     const inserted = context.db.writeTransaction(() => persist());
     return agy ? result(inserted) : { ...result(inserted), hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, baseKey) } } };

package/dist/services/lifecycle-invocations.js

@@ -60,6 +60,11 @@ export function assertAuxiliaryCommandScope(context, command, projectRoot) {
     }
     throw new AppError("invocation_scope_unavailable", "Auxiliary command has no live managed daemon binding", 1, { phase: "prepare", effect: "no_effect" });
 }
+function sameNativeCall(left, right) {
+    const a = JSON.parse(left), b = JSON.parse(right);
+    // Parent and execution route are immutable facts, not a different call ID.
+    return [0, 1, 2, 4].every(index => a[index] === b[index]);
+}
 // Conclusive result/check rejections, never transport, ownership, registry or
 // unknown-effect failures. These validators reject before accepting the result.
 export function isRetryableLifecycleRejection(code, details = {}) {
@@ -567,6 +572,8 @@ export function managedLifecycleCommand(context, command, options = {}) {
     const scope = JSON.parse(configured);
     command = canonicalManagedCommand(context, command, scope);
     const parsed = invocation(command);
+    if (options.freshWorkAttempt && !["work_finish", "work_fail"].includes(parsed.operation))
+        throw new AppError("invocation_command_mismatch", "Fresh Work packet may only issue Work settlement commands", 1);
     const suppliedId = commandOption(parsed, "invocation-id");
     // An invocation id is authority, never decorative text.  In particular,
     // callers that add arguments after rendering must not be able to reuse an
@@ -590,7 +597,7 @@ export function managedLifecycleCommand(context, command, options = {}) {
     }
     storage(context);
     return context.db.writeTransaction(() => {
-        const prior = context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]);
+        const prior = options.freshWorkAttempt ? undefined : context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]);
         if (prior && prior.id !== context.env.DD_FLOW_CURRENT_INVOCATION) {
             const replacesAnswer = options.replaceUnobservedAnswer && parsed.operation === "stage_resume"
                 && (prior.status === "settled" || commandOption(invocation(prior.command), "answer-file") !== commandOption(parsed, "answer-file"));
@@ -817,6 +824,39 @@ export function issueLifecycleInvocation(context, command, scope) {
     context.db.run("INSERT INTO lifecycle_invocations (id, scope_json, command, fingerprint, status, created_at, updated_at) VALUES (?, ?, ?, ?, 'issued', ?, ?)", [id, row.scope_json, prepared, row.fingerprint, context.now(), context.now()]);
     return { id, command: prepared };
 }
+/** Prepare outside a write transaction; the Work retry CAS owns issuance. */
+export function prepareWorkStartAuthority(context, command, previousId) {
+    const prior = previousId ? load(context, previousId) : null;
+    const configured = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!configured && !prior)
+        return null;
+    const scope = JSON.parse(configured ?? prior.scope_json);
+    if (prior && prior.scope_json !== JSON.stringify(scope))
+        throw new AppError("invocation_scope_mismatch", "Work start belongs to another controller scope", 1);
+    command = canonicalManagedCommand(context, command, scope);
+    const { parsed } = prepareLifecycleIssuance(command, scope);
+    if (parsed.operation !== "work_start")
+        throw new AppError("invocation_command_mismatch", "Work authority must start its Work", 1);
+    if (prior && prior.fingerprint !== fingerprint(parsed))
+        throw new AppError("invocation_command_mismatch", "Retained Work start authority belongs to a different Work", 1, { invocation_id: prior.id });
+    assertLifecycleInvocationCurrent(context, scope, command);
+    return { command, scope };
+}
+/** Caller owns the retry CAS. Preserve settled outcomes; never steal an
+ * observed/executing terminal operation from the previous Work attempt. */
+export function retireWorkPacketAuthorities(context, workId) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'lifecycle_packet_assignments'"))
+        return;
+    const attempts = context.db.all("SELECT DISTINCT li.* FROM lifecycle_invocations li JOIN lifecycle_packet_assignments pa ON pa.invocation_id=li.id JOIN work_sessions ws ON pa.packet_sha256=json_extract(ws.start_receipt_json,'$.prompt_sha256') WHERE ws.work_id=?", [workId]);
+    for (const attempt of attempts) {
+        if (!["work_finish", "work_fail"].includes(invocation(attempt.command).operation))
+            continue;
+        if (["observed", "executing"].includes(attempt.status))
+            throw new AppError("work_retry_incomplete", "Previous Work settlement still has native authority in flight", 1, { work_id: workId, invocation_id: attempt.id });
+        if (attempt.status === "issued")
+            context.db.run("UPDATE lifecycle_invocations SET status='expired',updated_at=? WHERE id=? AND status='issued'", [context.now(), attempt.id]);
+    }
+}
 function commandWithInvocationId(command, id) {
     const at = shellSuffixOffset(command);
     const suffix = command.slice(at);
@@ -836,8 +876,10 @@ function assertRenderableInvocation(row) {
 function renderInvocationCommand(row, command) {
     assertRenderableInvocation(row);
     const parsed = invocation(command);
-    if (commandOption(parsed, "invocation-id"))
-        throw new AppError("invocation_command_invalid", "Rendered lifecycle command already has an invocation id", 1);
+    if (commandOption(parsed, "invocation-id")) {
+        checkCommand(row, command);
+        return command;
+    }
     const rendered = commandWithInvocationId(command, row.id);
     checkCommand(row, rendered);
     return rendered;
@@ -1175,6 +1217,18 @@ export function isControllerManagedInvocation(context, projectRoot, runId) {
 /** recordReceipt is a synchronous SQL-only hook ingress callback. Native
  * adapters must prepare any filesystem or process evidence before calling. */
 export function observeLifecycleInvocation(context, input) {
+    const priorReceipt = input.currentEventKey && input.projectId
+        && context.db.get("SELECT 1 FROM hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, input.currentEventKey]);
+    const result = observeLifecycleInvocationReceipt(context, input);
+    // Hook-only calls have no invocation row, but their immutable receipt still
+    // distinguishes a repeated native delivery from a new observation.
+    if (priorReceipt && result.disposition === "admitted" && result.eventKey === input.currentEventKey) {
+        result.disposition = "replay";
+        result.duplicate = true;
+    }
+    return { ...result, currentEventKey: input.currentEventKey ?? null, authoritativeEventKey: result.eventKey ?? null };
+}
+function observeLifecycleInvocationReceipt(context, input) {
     storage(context);
     const projectRoot = input.projectId ? context.db.get("SELECT root FROM projects WHERE id = ?", [input.projectId])?.root : undefined;
     const provenScope = projectRoot && input.harness ? managedNativeInvocationScope(context, projectRoot, input.identity, input.harness) : null;
@@ -1246,7 +1300,7 @@ export function observeLifecycleInvocation(context, input) {
         }
         if (analysis.kind !== "none")
             throw new AppError("lifecycle_shell_syntax_invalid", "This shell form cannot bind exactly one lifecycle execution; use the exact issued lifecycle command without the unsupported shell context", 1, { phase: "prepare", effect: "no_effect", recoverable: true, disposition: "pre_cli_shell_refusal", reason: analysis.kind === "compound" ? analysis.reason : "unsupported_lifecycle_command", event_key: eventKey, ...issuedBarrier });
-        return { eventKey, duplicate: false, invocationId: null };
+        return { eventKey, duplicate: false, disposition: "admitted", invocationId: null };
     }
     // Admit the one parsed leaf, never execute or fingerprint the prefix/suffix.
     const leafCommand = analysis.invocation.command;
@@ -1269,7 +1323,7 @@ export function observeLifecycleInvocation(context, input) {
             return false;
         }
         if (row.identity_json && row.identity_json !== deliveredIdentity
-            && JSON.stringify(JSON.parse(row.identity_json).slice(0, 5)) === JSON.stringify(JSON.parse(deliveredIdentity).slice(0, 5))) {
+            && sameNativeCall(row.identity_json, deliveredIdentity)) {
             throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
         }
         if (row.status === "executing" && row.identity_json !== deliveredIdentity)
@@ -1302,7 +1356,7 @@ export function observeLifecycleInvocation(context, input) {
             if (retainedOwner !== ownerSnapshot())
                 throw new AppError("invocation_scope_unproven", "Native owner changed before hook-only recovery receipt", 1, { effect: "no_effect" });
             const eventKey = input.recordReceipt();
-            return { eventKey, duplicate: false, invocationId: null };
+            return { eventKey, duplicate: false, disposition: "admitted", invocationId: null };
         });
     }
     const resolved = input.id === initial.id ? {} : { invocationId: initial.id };
@@ -1313,7 +1367,7 @@ export function observeLifecycleInvocation(context, input) {
     // reattach. Do not manufacture a new receipt or reject that read as a second
     // executor; the CLI returns the immutable stored outcome without dispatch.
     if (initial.status === "settled")
-        return { eventKey: initial.event_key, duplicate: true, ...resolved };
+        return { eventKey: initial.event_key, duplicate: true, disposition: initial.identity_json === deliveredIdentity ? "replay" : "settled_read", ...resolved };
     const project = requireProjectByRoot(context, scope.projectRoot);
     const identity = input.identity;
     const identityJson = deliveredIdentity;
@@ -1324,16 +1378,16 @@ export function observeLifecycleInvocation(context, input) {
         if (row.scope_json !== initial.scope_json)
             throw new AppError("invocation_scope_mismatch", "Lifecycle scope changed before native receipt", 1, { effect: "no_effect" });
         if (row.status === "settled")
-            return { eventKey: row.event_key, duplicate: true, ...resolved };
+            return { eventKey: row.event_key, duplicate: true, disposition: row.identity_json === identityJson ? "replay" : "settled_read", ...resolved };
         // Observation records native facts only. CLI owns deadline, argument and
         // RUN-state validation, including decisions about retrying an invocation.
         if (row.status === "expired" || (row.deadline !== null && row.deadline <= Date.now() && !row.event_key)) {
-            return { eventKey: row.event_key, duplicate: true, ...resolved };
+            return { eventKey: row.event_key, duplicate: true, disposition: "expired", ...resolved };
         }
         if (row.identity_json === identityJson) {
-            return { eventKey: row.event_key, duplicate: true, ...resolved };
+            return { eventKey: row.event_key, duplicate: true, disposition: "replay", ...resolved };
         }
-        if (row.identity_json && JSON.stringify(JSON.parse(row.identity_json).slice(0, 5)) === JSON.stringify(JSON.parse(identityJson).slice(0, 5))) {
+        if (row.identity_json && sameNativeCall(row.identity_json, identityJson)) {
             throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
         }
         const eventKey = input.recordReceipt({ projectRoot: scope.projectRoot, runId: scope.runId, command: initial.command });
@@ -1353,7 +1407,7 @@ export function observeLifecycleInvocation(context, input) {
         const updated = context.db.run("UPDATE lifecycle_invocations SET identity_json = ?, event_key = ?, status = 'observed', updated_at = ? WHERE id = ? AND status IN ('issued', 'observed')", [identityJson, eventKey, context.now(), initial.id]);
         // Once execution has been claimed, later PreToolUse observations are
         // retained as hook evidence but cannot replace the executor's receipt.
-        return { eventKey: updated.changes === 1 ? eventKey : row.event_key, duplicate: updated.changes !== 1, ...resolved };
+        return { eventKey: updated.changes === 1 ? eventKey : row.event_key, duplicate: updated.changes !== 1, disposition: updated.changes === 1 ? "admitted" : "in_flight", ...resolved };
     });
 }
 /** Correlate exact native argv for diagnostics, independently of assignment

package/dist/services/vnext-fanout.js

@@ -11,6 +11,7 @@ import { reconcileUnfinishedChecks } from "./code-checks.js";
 import { vnextStageDirectory } from "../domain/stage-catalog.js";
 import { stageWorkIds, stageGraphScope } from "./stage-work-graph.js";
 import { eligibleCodexChildOverload } from "./codex-capacity.js";
+import { safeNativeFailure } from "../harness-runtime/lib/native-children.mjs";
 export const subagentCapacityKey = "runtime.subagent.available_slots";
 /** External concurrency is policy, never evidence of native child qualification. */
 export function getStageFanoutCapacity(context, input) {
@@ -175,7 +176,11 @@ export async function reconcileVnextFanout(context, input) {
             issues.push({ code: "execution_ended_without_work_result", work_id: link.work_id, session_id: child.session_id });
             continue;
         }
-        const reason = JSON.stringify({ source: "native_child_observation", harness_id: value.harness_id, session_id: child.session_id, work_session_id: link.id, outcome: child.status });
+        const providerError = safeNativeFailure(child.provider_error);
+        const reason = JSON.stringify({ source: "native_child_observation", harness_id: value.harness_id, session_id: child.session_id, work_session_id: link.id, outcome: child.status,
+            ...(typeof child.terminal_turn_id === "string" ? { terminal_turn_id: child.terminal_turn_id } : {}),
+            ...(typeof child.terminal_observed_at === "string" ? { terminal_observed_at: child.terminal_observed_at } : {}),
+            ...(providerError ? { provider_error: providerError } : {}) });
         const result = await (child.status === "failed" ? failWork : cancelWork)(context, link.work_id, reason);
         reconciled.push({ work_id: link.work_id, work_session_id: link.id, outcome: child.status, result });
     }

package/dist/services/work-registry.js

@@ -1,4 +1,4 @@
-import { bindLifecyclePacketAssignments, managedLifecycleCommand } from "./lifecycle-invocations.js";
+import { bindLifecyclePacketAssignments, managedLifecycleCommand, prepareWorkStartAuthority, issueLifecycleInvocation, retireWorkPacketAuthorities } from "./lifecycle-invocations.js";
 import { bindStageWork, currentStageWorkIds, stageWorkIds } from "./stage-work-graph.js";
 import { runtimeCommand } from "./runtime-command.js";
 import crypto from "node:crypto";
@@ -449,7 +449,38 @@ export function shortWorkId(id) { return shortEntityReference(id); }
  * PATH is not inherited; using the shared lifecycle command keeps them on the
  * same captured runtime as their parent stage.
  */
-export function workStartCommand(context, work) { const run = requireRun(context, work.project_id, work.run_id); const recovery = recoveryGuard(context, work.project_id, work.run_id); return managedLifecycleCommand(context, runtimeCommand(context, ["work", "start", shortWorkId(work.work_id), "--project-root", run.project_root, ...(recovery ? ["--recovery-id", recovery.recovery_id] : []), "--json"])); }
+function rawWorkStartCommand(context, work) {
+    const run = requireRun(context, work.project_id, work.run_id), recovery = recoveryGuard(context, work.project_id, work.run_id);
+    return runtimeCommand(context, ["work", "start", shortWorkId(work.work_id), "--project-root", run.project_root, ...(recovery ? ["--recovery-id", recovery.recovery_id] : []), "--json"]);
+}
+export function workStartCommand(context, work) {
+    const command = rawWorkStartCommand(context, work);
+    const retained = context.db.get("SELECT status,current_start_invocation_id FROM works WHERE work_id = ?", [work.work_id]);
+    if (retained?.current_start_invocation_id) {
+        const prepared = prepareWorkStartAuthority(context, command, retained.current_start_invocation_id);
+        return managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: JSON.stringify(prepared.scope) } }, `${command} --invocation-id ${retained.current_start_invocation_id}`);
+    }
+    // Legacy terminal/running Work is historical, never a fresh dispatch.
+    if (retained?.status !== "created")
+        return managedLifecycleCommand(context, command);
+    const prepared = prepareWorkStartAuthority(context, command);
+    if (!prepared)
+        return command;
+    if (!context.db.writable || context.env.DD_FLOW_INVOCATION_READONLY === "1")
+        throw new AppError("invocation_command_unprepared", "Work start authority has not been prepared", 1);
+    const id = context.db.writeTransaction(() => {
+        assertRunMutationAllowed(context, work.project_id, work.run_id, prepared.scope.generation);
+        const current = context.db.get("SELECT status,current_start_invocation_id FROM works WHERE work_id = ?", [work.work_id]);
+        if (current?.current_start_invocation_id)
+            return current.current_start_invocation_id;
+        if (current?.status !== "created")
+            throw new AppError("work_retry_conflict", "Work changed before start issuance", 1);
+        const issued = issueLifecycleInvocation(context, prepared.command, prepared.scope);
+        context.db.run("UPDATE works SET current_start_invocation_id = ? WHERE work_id = ?", [issued.id, work.work_id]);
+        return issued.id;
+    });
+    return managedLifecycleCommand(context, `${command} --invocation-id ${id}`);
+}
 export function assertWorkLaunchReady(context, id) {
     ensureWorkRegistry(context);
     const work = requireWork(context, id);
@@ -639,7 +670,10 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
             if (JSON.stringify(dependencyResults) !== JSON.stringify(preparedDependencies) || JSON.stringify(recovery) !== JSON.stringify(preparedRecovery))
                 throw new AppError("work_not_ready", "Work dependencies or recovery segment changed while preparing its packet", 2, { work_id: current.work_id });
             const assignments = new Set();
-            const commands = workerLifecycleCommands({ ...context, captureLifecycleAssignment: (id) => assignments.add(id) }, current, workerRun);
+            const currentStart = context.db.get("SELECT current_start_invocation_id FROM works WHERE work_id = ?", [work.work_id])?.current_start_invocation_id;
+            if (currentStart && context.env.DD_FLOW_CURRENT_INVOCATION && currentStart !== context.env.DD_FLOW_CURRENT_INVOCATION)
+                throw new AppError("work_generation_stale", "Work start authority belongs to an earlier attempt", 1, { work_id: work.work_id });
+            const commands = workerLifecycleCommands({ ...context, captureLifecycleAssignment: (id) => assignments.add(id) }, current, workerRun, true);
             const prompt = promptTemplate.replace(finishMarker, commands.finish).replace(failMarker, commands.fail);
             bindLifecyclePacketAssignments(context, prompt, assignments);
             const workContext = { schema_id: "dd-flow/work-context@1", run_id: current.run_id, work_id: current.work_id, parent_work_id: current.parent_work_id, project_root: run.project_root, workspace_root: workerRun.workspace_root, run_root: requireRunHome(run), depends_on: parseDependencies(current), launch_policy: current.launch_policy, result_schema: current.result_schema, read_only: readOnly, ...(recovery ? { recovery } : {}), ...(readOnly ? { workspace_fingerprint: fingerprint, ...(reviewInput ? { review_input: reviewInput } : {}), ...(reviewCopy ? { review_copy: reviewCopy } : {}) } : {}) };
@@ -771,7 +805,7 @@ export function prepareWorkRetry(context, id, reason) {
             throw new AppError("work_retry_invalid", "Retry journal is not valid JSON", 1);
         }
         const item = value;
-        if (!item || typeof item !== "object" || item.work_id !== work.work_id || typeof item.archive !== "string" || !/^ATT-\d{3,}$/.test(item.archive) || !Array.isArray(item.entries) || item.entries.some(file => !["prompt.md", "result.json", "context.json"].includes(file)) || new Set(item.entries).size !== item.entries.length || !(item.result_sha256 === null || typeof item.result_sha256 === "string" && /^[a-f0-9]{64}$/.test(item.result_sha256)))
+        if (!item || typeof item !== "object" || item.work_id !== work.work_id || typeof item.archive !== "string" || !/^ATT-\d{3,}$/.test(item.archive) || !Array.isArray(item.entries) || item.entries.some(file => !["prompt.md", "result.json", "context.json", "result-input.json"].includes(file)) || new Set(item.entries).size !== item.entries.length || !(item.result_sha256 === null || typeof item.result_sha256 === "string" && /^[a-f0-9]{64}$/.test(item.result_sha256)))
             throw new AppError("work_retry_invalid", "Retry journal does not identify this Work", 1);
         pending = item;
     }
@@ -781,7 +815,7 @@ export function prepareWorkRetry(context, id, reason) {
     let number = 1;
     while (fs.existsSync(path.join(attempts, `ATT-${String(number).padStart(3, "0")}`)))
         number += 1;
-    const prepared = pending ?? { work_id: work.work_id, archive: `ATT-${String(number).padStart(3, "0")}`, entries: ["prompt.md", "result.json", "context.json"].filter(file => fs.existsSync(path.join(directory, file))), result_sha256: work.result === null ? null : crypto.createHash("sha256").update(work.result).digest("hex") };
+    const prepared = pending ?? { work_id: work.work_id, archive: `ATT-${String(number).padStart(3, "0")}`, entries: ["prompt.md", "result.json", "context.json", "result-input.json"].filter(file => fs.existsSync(path.join(directory, file))), result_sha256: work.result === null ? null : crypto.createHash("sha256").update(work.result).digest("hex") };
     const archive = path.join(attempts, prepared.archive);
     if (work.status === "failed") {
         if (prepared.result_sha256 !== (work.result === null ? null : crypto.createHash("sha256").update(work.result).digest("hex")))
@@ -805,6 +839,8 @@ export function retryWork(context, id, reason) {
     // live path can be archived for the next attempt.
     materializePendingWorkResults(context, pending.project_id, pending.run_id, pending.work_id);
     const { work, run, directory, journal, pending: retainedJournal, prepared, archive } = prepareWorkRetry(context, id, reason);
+    const previousStart = context.db.get("SELECT current_start_invocation_id FROM works WHERE work_id = ?", [id])?.current_start_invocation_id;
+    const startAuthority = work.status === "failed" ? prepareWorkStartAuthority(context, rawWorkStartCommand(context, work), previousStart) : null;
     if (work.status === "failed") {
         // The durable journal and archive are projections of the failed SQL
         // receipt. They must finish before the short transaction opens a new
@@ -836,15 +872,18 @@ export function retryWork(context, id, reason) {
         }
         context.db.writeTransaction(() => {
             const current = requireWork(context, work.work_id);
-            assertRunMutationAllowed(context, current.project_id, current.run_id);
+            assertRunMutationAllowed(context, current.project_id, current.run_id, startAuthority?.scope.generation);
             if (current.status !== "failed" || current.result !== work.result || current.updated_at !== work.updated_at)
                 throw new AppError("work_retry_conflict", "Failed Work receipt changed during retry", 1);
+            retireWorkPacketAuthorities(context, work.work_id);
             for (const column of ["prompt_path", "result_path"]) {
                 const file = column === "prompt_path" ? "prompt.md" : "result.json";
                 context.db.run(`UPDATE work_sessions SET ${column} = ? WHERE work_id = ? AND ${column} = ?`, [path.join(archive, file), work.work_id, path.join(directory, file)]);
             }
             if (context.db.run("UPDATE works SET status = 'created', result = NULL, started_at = NULL, completed_at = NULL, updated_at = ? WHERE work_id = ? AND status = 'failed'", [context.now(), work.work_id]).changes !== 1)
                 throw new AppError("work_retry_conflict", "Failed Work changed during retry", 1);
+            const startId = startAuthority ? issueLifecycleInvocation(context, startAuthority.command, startAuthority.scope).id : null;
+            context.db.run("UPDATE works SET current_start_invocation_id = ? WHERE work_id = ?", [startId, work.work_id]);
         });
     }
     fs.rmSync(journal, { force: true });
@@ -1138,8 +1177,12 @@ async function settle(context, id, status, result, progress, retry) {
     const control = runControlDirective(context, work.project_id, work.run_id);
     const newlyReady = control ? [] : context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? AND status = 'created' ORDER BY created_at, work_id`, [work.project_id, work.run_id]).filter((candidate) => isReady(context, candidate)).map((candidate) => ({ work_id: candidate.work_id, launch_policy: candidate.launch_policy, start_command: workStartCommand(context, candidate) }));
     appendFlowRunTimelineEvent(context, work.project_id, work.run_id, { type: `work_${status}`, work_id: work.work_id, session_id: link?.session_id ?? null, ...(coordinationDrift.length ? { coordination_drift: coordinationDrift } : {}) });
-    for (const ready of newlyReady)
-        appendFlowRunTimelineEvent(context, work.project_id, work.run_id, { type: "work_dependency_unblocked", work_id: ready.work_id, completed_dependency: work.work_id });
+    if (status === "completed")
+        for (const ready of newlyReady) {
+            const candidate = requireWork(context, ready.work_id);
+            if (parseDependencies(candidate).includes(work.work_id))
+                appendFlowRunTimelineEvent(context, work.project_id, work.run_id, { type: "work_dependency_unblocked", work_id: ready.work_id, completed_dependency: work.work_id });
+        }
     return { ok: true, ...(control ? { control } : {}), work_id: id, status, checks: receipts, coordination: { planned_write_areas: codePacket(work)?.planned_write_areas ?? [], drift: coordinationDrift }, newly_ready: newlyReady, graph: codeWorkGraph(context, work.project_id, work.run_id), usage: { status: "provisional", reason: "final usage is controller-owned" } };
 }
 function recoveryPrompt(recovery) { return ["<recovery_identity>", `- recovery_id: ${recovery.recoveryId}`, `- execution_generation: ${recovery.generation}`, "This Work was interrupted and is now an authorized recovery segment of the same assignment.", "</recovery_identity>", "", "<recovery_instructions>", `Read the retained pre-interruption evidence at ${recovery.evidencePath}.`, "Before changing files or rerunning a command, inspect the workspace, receipts, logs, and partial artifacts. Do not assume the last command succeeded or failed merely because its reply was lost.", "Preserve accepted work. Do not repeat completed Work, create undeclared Work, alter the original requirements, or edit dd-flow runtime state/evidence.", "Observe an existing check or finish instead of duplicating it. Retry only through an exact runtime retry command after establishing that its prior outcome permits it.", "Record the concrete unresolved operation rather than guessing if an external effect cannot be reconciled.", "</recovery_instructions>"].join("\n"); }
@@ -1291,11 +1334,11 @@ function renderWorkerPrompt(context, work, run, dependencies, commands, workspac
     const sources = matrix?.matrix.sources.filter(source => ["specify", "protocolize", "protocolize_report"].includes(source.role)) ?? [];
     return ["<accepted_decision_precedence>", `Read ${path.join(requireRunHome(run), "01-specify", "specify.json")} and later accepted RUN decisions relevant to this Work.`, ...sources.map(source => `Accepted ${source.role}: ${path.join(source.root === "run" ? requireRunHome(run) : run.workspace_root, source.path)} (sha256 ${source.sha256}). PROTOCOLIZE includes the effective amendments; preserve SPECIFY non-goals.`), acceptedDecisionPrecedence, "</accepted_decision_precedence>", "", body, verificationMatrixInstruction(matrix?.metadata ?? null, requireRunHome(run), `assigned Work ${work.work_id}`)].join("\n");
 }
-function workerLifecycleCommands(context, work, run) {
+function workerLifecycleCommands(context, work, run, freshWorkAttempt = false) {
     const resultInputPath = path.join(requireRunHome(run), "works", work.work_id, "result-input.json");
     return {
-        finish: managedLifecycleCommand(context, runtimeCommand(context, ["work", "finish", work.work_id, "--result-file", resultInputPath, "--project-root", run.project_root, "--json", "--progress-jsonl"])),
-        fail: managedLifecycleCommand(context, runtimeCommand(context, ["work", "fail", shortWorkId(work.work_id), "--reason", "receipt path + exact external or semantic blocker", "--project-root", run.project_root, "--json"]))
+        finish: managedLifecycleCommand(context, runtimeCommand(context, ["work", "finish", work.work_id, "--result-file", resultInputPath, "--project-root", run.project_root, "--json", "--progress-jsonl"]), { freshWorkAttempt }),
+        fail: managedLifecycleCommand(context, runtimeCommand(context, ["work", "fail", shortWorkId(work.work_id), "--reason", "receipt path + exact external or semantic blocker", "--project-root", run.project_root, "--json"]), { freshWorkAttempt })
     };
 }
 function renderWorkerPromptBody(context, work, run, dependencies, commands) {

package/dist/storage/database.js

@@ -301,6 +301,9 @@ export function ensureVnextWorkStorage(db) {
     // A committed Work start is authoritative even if publishing its prompt
     // files is interrupted after commit.  Keep the exact bytes for repair.
     db.writeTransaction(() => {
+        const workColumns = db.all("PRAGMA table_info(works)");
+        if (!workColumns.some(column => column.name === "current_start_invocation_id"))
+            db.execSchema("ALTER TABLE works ADD COLUMN current_start_invocation_id TEXT");
         const columns = db.all("PRAGMA table_info(work_sessions)");
         if (!columns.some((column) => column.name === "start_receipt_json"))
             db.execSchema("ALTER TABLE work_sessions ADD COLUMN start_receipt_json TEXT");
@@ -1558,6 +1561,7 @@ function migrate(db) {
     ensureColumn(db, "runs", "layout_version", "ALTER TABLE runs ADD COLUMN layout_version TEXT");
     ensureColumn(db, "runs", "artifact_root_kind", "ALTER TABLE runs ADD COLUMN artifact_root_kind TEXT");
     ensureColumn(db, "works", "payload_json", "ALTER TABLE works ADD COLUMN payload_json TEXT");
+    ensureColumn(db, "works", "current_start_invocation_id", "ALTER TABLE works ADD COLUMN current_start_invocation_id TEXT");
     ensureColumn(db, "work_sessions", "start_receipt_json", "ALTER TABLE work_sessions ADD COLUMN start_receipt_json TEXT");
     ensureColumn(db, "work_sessions", "start_publication_status", "ALTER TABLE work_sessions ADD COLUMN start_publication_status TEXT");
     ensureColumn(db, "work_sessions", "result_receipt_json", "ALTER TABLE work_sessions ADD COLUMN result_receipt_json TEXT");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.133",
+  "version": "0.9.0-beta.134",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",